Data Processing Agreement (DPA)

This is an informational English translation. The Norwegian (Bokmål) version is legally authoritative; in case of any discrepancy, the Norwegian text controls.

This page shows AI-Flow’s standard Data Processing Agreement (DPA). For a specific engagement, a signed and dated version is executed as an attachment to the Statement of Work (SOW); in case of any discrepancy between this page and a signed agreement, the signed agreement prevails.

1. Background and status

This agreement is entered into between the Client (“controller”) and AI-Flow (registered legal name: AI-Flow Nowak, org. no. 937 399 359) (“processor”), and governs AI-Flow’s processing of personal data on the Client’s behalf in connection with agreed services. The agreement meets the requirements of GDPR art. 28(3), and is structured following Commission Implementing Decision (EU) 2021/915 on standard contractual clauses between controllers and processors, which has been incorporated into the EEA Agreement (EEA Joint Committee Decision No. 336/2022).

Public contracting authorities: Where the Client procures via Statens standardavtaler (SSA), the SSA attachment’s own data processing agreement takes precedence over this agreement on matters clearly and unambiguously related to data protection law.

2. Nature, purpose, and duration of processing

The nature and purpose of the processing follow from the individual SOW, and typically include: operating customer-service chatbots, phone helplines, lead generation, or candidate databases built for the Client. Processing continues for as long as the underlying engagement runs, unless otherwise agreed.

Categories of data subjects and personal data are defined specifically in the SOW for each engagement, and may for example include the Client’s employees, customers, or job applicants, with contact details and content from conversations/inquiries handled by the relevant solution.

3. Processor obligations

AI-Flow shall:

• process personal data only on the Client’s documented instructions, including regarding transfers to third countries, and notify the Client if, in AI-Flow’s assessment, an instruction conflicts with data protection law;
• ensure that persons with access to the data are bound by confidentiality, whether contractual or statutory;
• implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, cf. art. 32 (see section 6);
• assist the Client in responding to requests from data subjects exercising their rights (access, rectification, erasure, etc.);
• assist the Client in complying with its obligations under art. 32–36, including data protection impact assessments (DPIAs) where relevant to the engagement;
• notify the Client without undue delay after becoming aware of a personal data breach, with information sufficient for the Client to meet its own notification obligations to Datatilsynet and any affected individuals;
• at the Client’s choice, at the end of the engagement, delete or return all personal data and delete existing copies, unless retention is required by law, and document deletion on request;
• make available to the Client all information necessary to demonstrate compliance with this agreement, and enable and contribute to audits, including inspections, conducted by the Client or an auditor appointed by the Client, on reasonable notice.

4. Sub-processors

The Client grants AI-Flow general written authorisation to engage sub-processors. AI-Flow shall inform the Client of any intended change (addition or replacement) with sufficient advance notice for the Client to object. AI-Flow shall impose the same data protection obligations on any sub-processor as apply under this agreement.

Current sub-processors

Matomo run on AI-Flow’s own infrastructure (self-hosted) and are not treated as sub-processors — they are tools AI-Flow operates directly and has direct control over. If AI-Flow uses third-party AI services (e.g. Anthropic) in delivering a specific solution, this is specified in the SOW for that engagement, with its own assessment of the transfer basis.

This list is updated on an ongoing basis and dated at each change.

5. Transfers to third countries

Where processing involves transferring personal data outside the EEA, this relies on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and/or the EU-US Data Privacy Framework, where the recipient is certified. AI-Flow follows Datatilsynet’s guidance on transfers to the US and will notify the Client if the transfer basis changes materially.

6. Security measures

AI-Flow implements the following measures, proportionate to the risk of the relevant processing:

• encrypted transmission (HTTPS/TLS) for all traffic to and from the services;
• access control — only personnel who need access to deliver the service have access to the Client’s data;
• IP anonymisation, disabled cookies, and limited retention in self-hosted analytics infrastructure;
• regular backups of business-critical systems;
• log retention limits — operational logs are deleted after a defined period, normally 90 days.

Specific measures for a given engagement may be further specified in the SOW.

7. Liability

The parties’ liability under this agreement is governed by the liability clause in the general Terms and Conditions of Sale, unless expressly agreed otherwise for the relevant engagement. Nothing in this agreement limits either party’s liability towards data subjects or supervisory authorities under data protection law.

8. Effective date and duration

For each engagement, this agreement applies from the start of processing until the personal data has been deleted or returned in accordance with section 3, or until it is replaced by a signed agreement with the same or stricter content.

9. Contact and signing

To receive a signature-ready version of this agreement tailored to a specific engagement, contact:

AI-Flow · Toni Nowak · org. no. 937 399 359 MVA (Enhetsregisteret) contact@ai-flow.no · +47 458 66 499